CN102334112A - Method and system for virtual machine networking - Google Patents

Abstract

Aspects of a method and system for networking are provided. In this regard, one or more circuits and/or processors in a network adapter of a first network device may determine whether to communicate traffic between virtual machines running on the first network device via a path that resides solely within the first network device, or via a path that comprises a second network device that is external to the first network device. The determination may be based, at least in part, on characteristics of the traffic. The determination may be based, at least in part, on capabilities and/or available resources of the network adapter. The determination may be based, at least in part, on management information exchanged between the one or more circuits and/or processors and one or more of: software running on the first network device, the second network device, and a third network device.

Description

The method and system that is used for virtual machine network

Technical field

The present invention relates to network, more particularly, relate to a kind of method and system that is used for virtual machine network.

Background technology

Along with to the increasing gradually of the dependence of computer network, also increase with the demand of the network equipment more efficiently faster thereupon.But the often mutual contradiction of these two purposes.For example, in order to realize the efficiency propagation relevant with the utilization of resources, it is very popular that Intel Virtualization Technology becomes, but this technology tends in handling capacity and/or postpone that negative effect is arranged.For in the speed of virtual machine and/or postpone to make moderate progress; Some network device architectures can not operate in the help of the virtual machine on this equipment and not have under the help of external network switch with software mode, one or more virtual machines that some network device architectures also can enable on this network equipment, to move directly and the direct communication of adapter of this equipment.By this way, can avoid and virtual switch or relevant delay and/or the bottleneck of external network switch based on software.In this respect, function such as virtual ethernet bridge (VEB) are not having the external network switch to help to realize down communication between VM (VM, virtual machine, virtual machine), and standard/protocol such as VEPA are through communication in the particular outer network switch realization VM.Although solution such as VEB solve and virtual some relevant problems with VEPA, they do not solve other some problems relevant with virtualization, and, in fact also produced some additional problems.

Compare the follow-up system that will combine accompanying drawing to introduce of the present invention, other limitation of prior art and drawback are conspicuous for the those of ordinary skill of ability field.

Summary of the invention

The invention provides a kind of system and/or method that is used for virtual machine network, describe in detail, and in claim, obtained more complete elaboration in conjunction with at least one width of cloth accompanying drawing.

Various advantage of the present invention, various aspects and character of innovation, and the details of the embodiment of institute's example wherein will describe in detail in following instructions and accompanying drawing.

Description of drawings

To combine accompanying drawing and embodiment that the present invention is described further below, in the accompanying drawing:

Fig. 1 is the synoptic diagram according to embodiment of the invention explanation demonstration network equipment;

Fig. 2 is another synoptic diagram according to embodiment of the invention explanation demonstration network equipment;

Fig. 3 A and 3B are that explanation is striden the variable synoptic diagram of virtual machine flow by the handled clean culture of the network equipment according to the embodiment of the invention, and the said network equipment comprises the entity that is used for variable virtual machine communication;

Fig. 4 is the synoptic diagram of striding the virtual machine flow according to the embodiments of the invention explanation through external device processes;

Fig. 5 A and 5B have explained the transmission of flux of multicast according to embodiments of the invention, and have showed thenetwork equipment 102 and 112;

Fig. 6 strides duplicating or the synoptic diagram of mirror image of virtual machine flow according to what embodiments of the invention explanations was used for network management;

Fig. 7 is the process flow diagram that the exemplary steps of VM flow is handled in explanation according to embodiments of the invention;

Fig. 8 explains in network adapter based on the content inside of address table or the process flow diagram of external treatment flow according to embodiments of the invention.

Embodiment

Embodiments of the invention provide a kind of method and system that is used for virtual machine network.In each item embodiment of the present invention; In the network adapter of first network equipment; One or more circuit and/or processor can determine it is through only being positioned at the path of first network equipment, still coming delivery flow rate between the virtual machine that moves on first network equipment through the path that is included in second network equipment outside first network equipment.This decision can be at least in part based on the characteristic of flow.。This decision can be dependent on the performance and/or the available resources of network adapter at least in part.This decision is the management information that is dependent on exchange between one or more circuit and/or processor and the following at least one item of part at least: the software that on first network equipment, moves, second network equipment and the 3rd network equipment.On behalf of first network equipment, second network equipment can participate in NMP.Can be through API (API) the exchange network management information that provides by one or more circuit and/or processor.

Not under the situation in the address table in network adapter, come delivery flow rate in the address information relevant through the path that comprises second network equipment with flow.Can not carry out when handling the needed one or more security function of flow when network adapter, come delivery flow rate through the path that comprises second network equipment.When network adapter can not be carried out when handling the needed one or more management function of flow, through comprising the path delivery flow rate of second network equipment.Coming through the path that comprises second network equipment under the situation of delivery flow rate, second network equipment can be handled said flow, is back to first network equipment to the flow of handling then.The processing of being carried out by second network equipment can comprise, for example searches the address information relevant with flow in the address table in second network equipment, carries out and handle the required one or more management functions of flow and/or carry out the required one or more security functions of processing flow.

One or more circuit and/or processor also can be used for being sent to second network equipment the copy of flow or about the report of flow, and second network equipment can remove to utilize the copy of flow for bookkeeping.One or more labels, field and/or the header file of flow copy can enable second network equipment and confirm that this flow copy is a copy.Indication from one or more circuit and/or processor can make second network equipment confirm that this flow copy is a copy.Can outside the band of this flow copy, transmit should indication.

Fig. 1 has explained demonstration network equipment synoptic diagram according to embodiments of the invention.As shown in Figure 1, the network equipment 102 comprisesprimary processor 104,primary memory 106,storer 116, I/O subsystem 108 and network adapter 110.Fig. 1 has also showed second network equipment 112: by the remaining subnetwork of cloud (cloud) 114 representatives and thenetwork management entity 122 that is arranged incloud 114.

In order to explain, can suppose that the network equipment 102 is servers, and can suppose that thenetwork equipment 112 is the network switch, but these equipment not to be subject to this.In thenetwork equipment 102 and 112 each can be any suitable network equipment, comprises PC, large scale computer, mobile device, router, bridge, switch, STB, modulator-demodular unit and head end (head-end).

Thenetwork equipment 112 can be similar with a lot of aspects of the network equipment 102.In this respect, thenetwork equipment 112 can comprise suitable logic, circuit, interface and/or code, is used to be engaged in network communication and based on one or more network standard deal with data.Unlike many conventional switch, thenetwork equipment 112 can be used for through receiving the identical port such asport 220 converting flows of flow.In this respect, thenetwork equipment 112 can be supported VEPA or similar agreement.Thenetwork equipment 112 can be used for moving as the administration agent of the network equipment 102.In this respect, thenetwork equipment 112 can be used for representing the network equipment 102 to be engaged in management agreement such as Port Mirroring, Spanning-Tree Protocol, multichain connects translucent interconnected (TRILL) and Simple Network Management Protocol (SNMP).That is to say that the network equipment 102 can interact with the network management entity of representing the network equipment 102 122.Therefore, thenetwork equipment 112 can be used for and the network equipment 102 exchange of management information, and the flow of the transmission between thenetwork equipment 102 and 112 of these exchanges and other is in the band or outside being with.

The agency that thenetwork equipment 112 also can be used as any other management entity moves, and this management entity is intended to managing network device 102 and/or its assembly (like virtual switch (vSwitch)).This management can comprise, the for example configuration of control network devices 102 or its assembly, implements the relevant statistics of safety, collection and the network equipment 102 or its assembly or the instrument of permission debugging network equipment 102 or its assembly is provided for the network equipment 102 or its assembly.In some embodiments of the invention, another management entity can be similar in appearance to the network equipment 102, just look like it be a part local or network equipment 112.In other embodiments of the invention, another management entity can be similar in appearance to the network equipment 102, just looks like it and thenetwork equipment 112 independences and is intended to through thenetwork equipment 112 as the agency management function is provided.

Network adapter 110 can be connected with thenetwork equipment 112 through link 124.In this respect,link 124 can make flow separation instrumentation (off-device), that is to say, in device external.Link can comprise like copper conductor, fiber optic cables, one or more wireless channel and/or their combination.

Primary processor 104 can comprise suitable logic, circuit, interface and/or code withprimary memory 106, and they can be realized to the processing of data and/or to the control of the network equipment 102 operations.Primary processor 104 can comprise like CPU, ARM or special IC (ASIC) based on X86.Primary memory 106 can comprise as being used to store the SRAM and/or the DRAM of data and/or instruction.Through utilizingprimary memory 106,primary processor 104 can be used for moving one or more operating systems and/or virtual machine (VM), and can be used for operation and/or controlled MOS and/or VM by supervisory routine.By this way, through utilizingprimary memory 106,primary processor 104 can be used for the operation of the various assemblies of control network devices 102.These assemblies can comprise software switch, also are known as virtual switch, and this software switch is used by supervisory routine, so that network connection and/or the connection between VM and thenetwork 114 between virtual machine are provided.

Storer 116 can comprise like hardware driver or solid-state memory.Storer 116 can be stored as can be through the local ground ofnetwork adapter 110 or the data of reading and writing and/or execution remotely.

I/O subsystem 108 can comprise suitable logic, circuit, interface and/or code, and they can be used for like the information between the various assemblies of delivery network equipment 102.The I/O subsystem can comprise one or more standardization buses and one or more bus controller.Therefore, I/O subsystem 108 can be used on the identification bus equipment, enumerate equipment on the bus, distribute and remove the communication on Resources allocation and/or the management bus for the various device on the bus.For example, I/O subsystem 108 can be the PCIe system, and comprises PCIe root complex (complex) and one or more PCIe switch and/or bridge.In certain embodiments, I/O subsystem 108 can be controlled by supervisory routine.

Network adapter 110 can comprise suitable logic, circuit, interface and/or code, and they can be used for abideing by one or more network standards and transmit and receive data.With reference to osi model,network adapter 110 can carry out physical layer function, data link layer functions and, in certain embodiments, carry out and the 3rd layer of OSI and the higher relevant function of osi layer.Similarly, with reference to the TCP/IP model,network adapter 110 can carry out network interface layer function, internet layer function and, in certain embodiments, carry out transport layer functionality and application level function.Networkadapter 110 can be as abideing by one or more ethernet standard communications of IEEE 802.3 definition, and can communicate by letter with other part of the network equipment 102 through I/O subsystem 108.Can enablenetwork adapter 110 utilize virtually, make it can be used as a plurality of network adapter oneself presenting to I/O subsystem 108 and/or external unit.For example, be under the situation of PCIe system at I/O subsystem 108, network adapter can be supported the SR-IOV standard.Therefore,network adapter 110 can be connected to I/O subsystem 108 through physical function (PF) 118 and/or one or more virtual functions (VF) 120.By this way,network adapter 110 possibly utilize virtual ethernet bridge (VEB) function (being also referred to as eSwitch) to go to support the direct communication with VMs, and can support the indirect communication with other VMs through vSwitch.In this respect, the VEB function can comprise some functions of IEEE 802.1 compatible switches, but may lack some common visible characteristics in the separate network switch.For example, can set address table rather than grope from service.VSwitch can be used by supervisory routine operation and/or control network devices 102 on the network equipment 102.With the direct communication of VMs can be via one or more VFs120 and/or PFs118, and with communicating by letter of vSwitch can be via one or more PFs118.

About the communication between the VMs; The legacy network adapter can or pass through to handle these all inner stream flows like VEB, or handles these all flows through external switch-utilization such as agreements such as virtual ethernet trunking device (VEPA), VNTag and port expanders.In this respect, be to utilize on network adapter, internally to handle to stride VM (inter-VM) flow such as the function of VEB, still utilize externally to handle and stride the VM flow such as the agreement of VEPA, this decision possibly receive the influence of multiple balance.For example, than the legacy network adapter, external unit can have more resources to go to support more characteristic, as supporting ACL (ACLs), debug function and the function of being supported by a plurality of standard network management tools.In this respect, comprise that on network adapter these characteristics will increase the cost that makes us hanging back and the complicacy of network adapter.On the other hand, in the external apparatus, but not in network adapter, exchange and the processing flow, can consume the more network bandwidth and postpone with increasing.VSwitch possibly be that its operation consumes several cpu cycles, and with compare through the VEB function direct communication that utilizes network adapter, possibly introduce more delay.

Therefore; Do not have the characteristic of implementing on the legacy network adapter and be used for and characteristic that other entity such as supervisory routine or external unit (network equipment 112) interact and increase to realize through network adapter being used to be implemented in;Network adapter 110 can utilize the entity that is used for variable virtual machine communication to realize the optimum balance between the parameter (like delay, outside bandwidth, cpu busy percentage and hardware cost/complexity).Network adapter 110 can be used for handling in many ways strides the VM flow, and the mode that flow is handled is according to multiple factor.In this respect; Can be onnetwork adapter 110 inter-process (exchange, encryption, deciphering, authentication etc.) flow; External treatment flow on thenetwork equipment 112; The resource ofadapter 110 Network Based and/or performance are handled flow, and/or adapter Network Based 110 is handled flow with the interaction of outside network device 112.The mode that the VM flow is striden in processing can be decided by each package or each data stream benchmark.

Network adapter 110 also can be in some cases, or some flows are used for inside to be transported and stride the VM flow and deliver to the external unit such as thenetwork equipment 112 to the copy or the report of striding the VM flow.About the copy of striding the VM flow and/or be reported among following Fig. 6 and describe.

Fig. 2 is the synoptic diagram that the management of the network equipment has been described according to embodiments of the invention.Fig. 2 has showed and driver 203₁-203_NRelevant virtual machine (VM) 202₁-202_N, and driver 206₁-206_MRelevant virtual machine (VM) 204₁-204_M, supervisory routine 208 and on the network equipment 102 operation virtual switch (vSwitch) 210.Fig. 2 has also showed entity (EFVS) 216 and (PF) 118 of the physical function innetwork adapter 110 and the virtual functions (VFs) 120 that is used for variable virtual machine communication₁-120_M

Virtual switch 210 can pass through driver 203₁-203_NMake flow travel to and fro between VMs 202₁-202_NTransport, and virtual switch can be included in a plurality of VMs 202₁-202_NMiddle resources shared.When driver 203₁-203_NWhen operating in the operational mode of supporting vSwitch, can directly not be connected, thereby makevirtual switch 210 andVMs 202 withnetwork adapter 110 hardware₁-202_NBetween communication need several processors cycle, and can the generation progress before executive communication postpone.Therefore, traversalvirtual switch 210 possibly produce some relevant expenses, and VMs 202₁-202_NMessage transmission rate that communicates and VMs 204₁-204_MThe message transmission rate that communicates is compared, and possibly be limited relatively.Conversely, for the purpose of data transmission, be applicable to the private resource withnetwork adapter 110 direct interactions, like driver 206₁-206_M, can be assigned to VMs 204₁-204_MThereby, make VMs 204₁-204_MCan walk aroundvirtual switch 210 with communicating by letter between the network adapter 110.By this way, can eliminate the expense relevant with virtual switch, just looking at up just looks like at VMs 204₁-204_MAnd direct connection arranged between thenetwork adapter 110, except other control operation of potential configuration of having to travel through virtual switch and network adapter PF possibly and/or some.These direct data connect can be by being used for realizing like making of special-purpose dique.

Therefore, compared to VMs 202₁-202_N, VMs 204₁-204_MCan support higher message transmission rate, littler delay with have the lower host CPU expense that is used to communicate by letter.Yet the VMs that why can continue to support to utilize virtual switch about the network equipment 102 is (as 202₁-202_N), there are various reasons.For example.VMs 204₁-204_MNeed more hardware, and therefore with regard to the cost or the complexity of the network equipment 102, support more VMs 204₁-204_MIt is unrealistic that this point can become; And the VMs202 that increases₁-202_NCan support by software.And legacy equipment and/or assembly possibly lack VMs 204₁-204_MSupport.Therefore the network equipment 102 possibly supported two types VMs, and the specific task that will carry out or function may determine the VM that gives can use the communication of what type.For convenience's sake, VMs 202₁-202_NBe called " VMs of virtual switchization " and VMs 204 in the present invention₁-204_MBe called " direct VMs.”

The entity (EFVC) 216 that is used for variable virtual machine communication can comprise suitable logic, circuit, interface and/or code, can realize the transmission of the management information betweennetwork adapter 110 and various other entity.For example, shown that likearrow 224 management information can be transmitted between EFVC 216 and internal entity, internal entity comprises entity such as supervisory routine 208 and/or any other inner management entity that the network equipment 102 is inner.Additionally or the two select one of which ground, shown that likearrow 226 management information can be transmitted between EFVC 216 and external entity, external entity comprises the entity that the network equipment 102 is outside, like thenetwork equipment 112 and/or any other external management entity.Relatively other is transferred tonetwork adapter 110 and/or from the flow ofnetwork adapter 110, the transmission of management information can be in the band.Additionally or the two select one of which ground, other flow relatively, the transmission of management information can be that band is outer, for example transmits through special-purpose physics and/or logic channel.For example, through API (API), can be tonetwork adapter 110 transmission or fromnetwork adapter 110 receiving management information.That is to say that EFVC216 can show API to one or more inside and/or external entity, and these entities can utilize API configure or Control Networkadapter 110.

EFVC 216 also can comprise suitable logic, circuit, interface and/or code, and they can be used for handling goes to and/or from VMs 202₁-202_NAnd/or VMs 204₁-204_MFlow.For example EFVC 216 can be used for carrying out packet exchange and other data number reason function like the collection of formulating ACL (ACLs), traffic mirroring, statistical information, the packet exchange that determines where to carry out the packet of giving, encryption, deciphering, authentication or the like.Can dispose and/or control the mode of EFVC 216 processing flows based on the management information of transmission, based on the resource of EFVC 216 resources and/or based on the resource of how to distribute EFVC 216.These information can comprise, for example comprise address table, ACL, global field name, iSCSI qualified name, the global field name of Ethernet optical-fibre channel (FCoE), ethernet type (as be used for FCoE initializtion protocol (FIP) ethernet type), statistics, error message and/or other and one ormore VMs 202 of the information (like MAC and/or VLAN address) that is used to transmit clean culture and/or flux of multicast₁-202_NAnd/or VMs 204₁-204_MRelevant information.Address table can comprise the information that is used to determine association or orders which type of port and/or VMs, various VLAN, MAC, IP, multicast and/or other network address, and can reference address voting orientation converting flow where.

In operation, EFVC 216 can the participative management transmission of Information, and can handle flow based on management information.By this way, another entity such as thenetwork equipment 112 or supervisory routine 208 administration agent that can be used asnetwork adapter 110 comes work.

Exemplary sequence through the step in the management of thenetwork equipment 112 is as follows.At first, can be between the EFVC 216 and thenetwork equipment 112 transmit management information.These transmission can be via like API and/or dedicated management passage.These transmission can comprise like the configuration of the operation of theEFVC 216 and thenetwork equipment 112 and/or the information of control model.In this respect, these transmission can comprise the transmission of performance that is used to support EFVC 216 of exchange and thenetwork equipment 112 of the performance of EFVC 216.By this way, can guarantee that thenetwork equipment 112 and EFVC 216 are compatible configurations.The expansion of one or more standard agreements such as LLDP and/or DCBX can carried out and can use to this exchange in band and/or outside the band.Secondly, thenetwork equipment 112 can provide and/or retrieve (retrieve) management information fornetwork management entity 122 according to management agreement such as Link Layer Discovery Protocol (LLDP) and/or data center's bridge joint exchange (DCBX).Then,network management entity 122 or virtual relevant management entity (like Vcenter or SCVMM) can be made the management decision based on management information.Network management entity 122 can generate corresponding management information based on this decision then, and is transferred to thenetwork equipment 112 to the management information that generates, thereby thenetwork equipment 112 is configured to handle the compatibility mode of striding the operation of VM flow with EVFC 216.112 transmission can be according to the expansion of management agreement such as DCBX and/or LLDP and/or DCBX fromnetwork management entity 122 to network entity.Thenetwork equipment 112 is transferred to EFVC 216 to decision and/or corresponding configuration information then.

Another exemplary sequence through the step in the management of thenetwork equipment 112 is as follows.At first, management information can be transmitted between the EFVC 216 and the network equipment 112.These transmission can be via like API and/or dedicated management passage.This information can comprise like the information history of the relevant VM of striding flow, expection, statistics, stride the VM flow by and/or can handle by network adapter 110.Secondly, thenetwork equipment 112 can be thatnetwork management entity 112 provides and/or searching, managing information according to management agreement such as DCBX, SNMP.Then,network management entity 122 or virtual relevant management entity can be made the management decision based on management information.Network management entity 122 then can generate management information based on this decision, and is transferred to thenetwork equipment 112 to the management information that generates.112 transmission can be according to the expansion of management agreement such as DCBX and/or LLDP and/or DCBX and/or SNMP fromnetwork management entity 122 to network entity.Thenetwork equipment 112 is transferred to EFVC 216 to decision then.

EFVC 226 can utilize management information to decide and how handle flow.In this respect; More as described in Figure 3 and/or some flow and as described in Figure 5 some flux of multicast can in the network equipment 102, handle; More as described in Figure 4 and/or some flow and as described in Figure 5 some flux of multicast can handle through the network equipment 102; As described in Figure 6, some and/or some flows can be in inter-process and the copy of this flow and/or the information that relates to this flow can be forwarded to thenetwork equipment 112 simultaneously.In this respect, wave filter and/or the regulation set up by network manager and/or network management entity can determine how stream handles flow.

Network manager and/or network management entity can freely be selected the required service of flow/processing standard, and where and how the decision of part handles flow at least conversely.In this respect, the mode of handling particular flow rate also can be according to the characteristic ofnetwork adapter 110 and with the characteristic of the flow that is processed.Therefore, the equipment of processing particular flow rate can change according to flow.For example, it still is in thenetwork equipment 112 that the exchange of particular flow rate occurs in thenetwork adapter 110, or occurs in some cases among the vSwitch 210, can change according to flow.About the characteristic ofnetwork adapter 110, handle the mode of flow and can how to distribute according to the hardware that occurs in thenetwork adapter 110 for example and/or software resource and resource.To the characteristic of flow, its processing mode can according to as one or more fields of the data stream relevant, flow (like resource address field, destination address field (DAF) or any other field) with flow in value, ACL or other security mechanism, with flow relevant Debugging message, this flow whether mirror image or will be by mirror image, with flow relevant delay requirement and/or flow be assigned with and/or needed bandwidth and/or some service are instructed like switch type port analysis (SPAN) or remote span (RSPAN) management of information.In some cases, user or keeper can tool using remove to discern the IA interchange address of particular flow rate.

Becausenetwork adapter 110 in the changeability of handling on the flow, can reach best balance between aspect the complicacy this another of this one side of delay, the network bandwidth and/or network congestion and network adapter 110.That is to say;Network adapter 110 can inter-process be striden quite a few of VM flow; Thereby the minimizing network congestion, can also realize more complicated service, realize the VMs that expansion is a large amount of and/or realize the service that expansion is a large amount of through utilizing some flows of external device processes.

Except about how handling the decision of flow; Control decision can also comprise as decision whether on the network equipment 102 the one or more VMs of instantiation, decision whether move to one or more VMs and/thereby the network equipment 102 of moving out goes the load on the balancing network, decision whether in address table or similar data structure modification information, make the decision of cooperating about the decision of network security and other and the entity of supervisory routine or manage program.

Fig. 3 A and Fig. 3 B have explained that according to embodiments of the invention the clean culture of being handled by the network equipment (comprise be used for variable virtual machine communicate by letter the entity of (EFVC)) strides the virtual machine flow.Shown in Fig. 3 A, (vSwitched)VM 202 ofpath 302 explanation virtual switchizationes₁VM 202 with virtual switchization_NBetween the exemplary virtual machine flow of striding; TheVM 202 ofpath 304 explanation virtual switchizationes_NWith direct VM 204₁Between the exemplary virtual machine flow of striding; The direct VM204 ofpath 306 explanations₁With direct VM 204_MBetween the exemplary virtual machine flow of striding.Other path, described like Fig. 4-6, can be used to allow these VM to be connected to thenetwork equipment 112.

EFVC 216 can management information such as address table (comprise like MAC Address and/or comprise the VLAN label of precedence information), ACL, other information similar and/or other relevant information, and EFVC 216 can be used for appropriate forwarding unicast traffic like this.In this respect, in some cases, EFVC216 can be used for the similar mode of legacy network switch be in operation learning management information such as address table.Through the supervisory routine 208 and/or thenetwork equipment 112, the information in the EFVC 216 can be filled bymanagement entity 122 yet in some cases.

In the exemplary scenarios that Fig. 3 A describes, the address table ofEFVC 216 is enough supported all VMs202₁-202_NAnd VMs204₁-204_MThat is to say that EFVC 216 can know port, through this port with any VMs 202₁-202_NWith VMs 204₁-204_MBe the destination converting flow.Therefore, EFVC 216 can be used for shown inpath 304 and 306, transmitting this unicast traffic, and need be to unnecessary port broadcast traffic.With regard to VMs 202₁-202_NBetween flow, shown inpath 302, these flows can be handled by vSwitch 210.

At Fig. 3 A,path 302 does not comprise the external unit such as the network equipment 112.Therefore, in order to letnetwork management entity 122 know the flow on thepath 302, supervisory routine 208 can be transferred tonetwork management entity 122 or another management entity to the management information that flow is relevant therewith.In this respect, supervisory routine 208 can directly offer this information thenetwork equipment 112 and/or can this information be provided through EFVC 216.At latter event, supervisory routine 208 can be transferred to EFVC 216 to management information, and conversely, information can be transferred tonetwork management entity 122 through thenetwork equipment 112 from EFVC 216.

In the described scene of Fig. 3 B, the address table ofEFVC 216 can sufficiently be supported all VMs204₁-204_M, but maybe not can sufficiently support VMs 202₁-202_NThat is to say that EFVC 216 possibly not know port, through this port with one or more VMs 202₁-202_NBe the destination converting flow.Yet compared to this flow is broadcast to all ports, shown inpath 350, EFVC 216 may be forwarded to thenetwork equipment 112 to this flow.When thenetwork equipment 112 operated in the VEPA pattern, it can know that this flow is the entity (like VM) that mails on the network equipment 102, thereby sends it back EFVC 216.Behind EFVC 216 return flows, because EFVC 216 knows all VMs 204₁-204_MThe address, it can confirm that this flow can not mail to any VMs 204₁-204_M, and possibly only can be transmitted to vSwitch 210 to flow, thereby avoided being broadcast to flow the needs of unnecessary port.In this respect, to all port broadcasting, by comparison, EFVC216 can not reduce or eliminate the necessity of this broadcasting through interacting with thenetwork equipment 112 to conventional switch when knowing accessibility destination port.

Fig. 4 has explained the synoptic diagram of striding the virtual machine flow through external device processes according to the embodiment of the invention.With reference to Fig. 4, path 402 has shownvirtual switch VM 202₁Withvirtual switch VM 202_NBetween the exemplary VM flow of striding; TheVM 202 of path 404 explanation virtual switchizationes_NWith direct VM 204₁Between the exemplary virtual machine flow of striding; The direct VM204 of path 406 explanations₁With direct VM 204_MBetween the exemplary virtual machine flow of striding.

EFVC 216 can management information such as address table, ACL, other information similar and/or other relevant information, thereby makes EFVC 216 know path 404 and 406, and 404 and 406 converting flows along the path that can be appropriate.In this respect, in some cases, do like the traditional exchange chance, EVFC 216 can be used for be in operation learning management information such as address table.Through the supervisory routine 208 and/or thenetwork equipment 112, the information in the EFVC 216 can be filled bymanagement entity 122 yet in some cases.

Path 402 does not comprise external unit, like the network equipment 112.Therefore, in order to letnetwork management entity 112 know the flow on the path 402, supervisory routine 208 can be transferred tonetwork management entity 112 or another management entity to the management information that flow is relevant therewith.In this respect, supervisory routine 208 can directly offer management information thenetwork equipment 112 and/or can this information be provided through EFVC 216.At latter event, supervisory routine 208 can be transferred to EFVC 216 to management information, and conversely, information can be transferred tonetwork management entity 122 through thenetwork equipment 112 from EFVC 216.Therefore, this information can be directly 402 transmission along the path, simultaneously thenetwork equipment 112 and EFVC 216 are configured to utilize the pattern of agreement (like VEPA, VNtag and port expansion).Yet path 402 also can be used in EFVC 216 break the banks and go inter-process to stride under the situation of VM flow.

Fig. 5 A and 5B have explained the transmission of flux of multicast according to embodiments of the invention.Fig. 5 A and 5B have showed thenetwork equipment 102 and 112.

For handling flux of multicast, EFVC 216 can canned data such as address table, other information similar and/or other relevant information, thereby make EFVC 216 can be used for appropriate forwarding multicasting flow.In this respect, the information in theEFVC 216 can be filled by supervisory routine 208, and/or is filled through thenetwork equipment 112 by network management entity 122.In various enforcements of the present invention, these address table possible capacities are limited, and at this point, EFVC 216 can utilize the service that provided by thenetwork equipment 112 and/or the advantage of function, for handling the performance that flux of multicast removes to expandEFVC 216.

Like the described scene of Fig. 5 A, all VMs204 of support that the address table ofEFVC 216 can be enough₁-204_MThat is to say EFVC 216 can know respectively can arrive VMs204 through which port₁-204_MIn each.Therefore shown inpath 502, to from VMs 202₁-202_NOne of them flux of multicast that sends, vSwitch 210 can be transmitted to the VMs202 that flow should be forwarded to flow₁-202_NIn any one or a plurality of, and EFVC 216 can be transmitted to the VMs 204 that flow should be forwarded to flux of multicast₁-204_MIn any one or a plurality of.With the outside equipment of the network equipment 102 is that the flux of multicast of destination can be sent to thenetwork equipment 112.

Yet, in the scene shown in Fig. 5 B, allVMs 202 of support that the address table of EFVC 216 is maybe not can enough₁-202_NFor example, EFVC 216 possibly not know how to arrive VM 204_MTherefore, thenetwork equipment 112 can be used for expanding as required the performance of EFVC 216.Therefore, shown inpath 552, to from VMs 202₁-202_NOne of them flux of multicast that sends, vSwitch 210 can control and be transmitted to theVMs 202 that should receive this flow to flux of multicast₁-202_NAny one or a plurality of; And EFVC 216 can be with VM 204_MFor the flux of multicast of destination sends to the network equipment 112.When thenetwork equipment 112 operated in the VEPA pattern, thenetwork equipment 112 can know that this flow is is the destination with the network equipment 102, can turn back to the network equipment 102 to flow then.Then EFVC 216 can deliver to VMs 204 to this flow₁-204_MIn it determined can order this flux of multicast any one or a plurality of, or EFVC 216 can be broadcast to all VMs 204 to flow₁-204_MTherefore, the scene shown in Fig. 5 B has shown VMs 204₁-204_MIn some can receive the situation of too much copy.Yet, be VMs 204 at the starting station₁-204_MOne of them situation under, through the inspection resource address and do not send to the starting station to it, EFVC 216 can guarantee that the starting station of flux of multicast is not replicated.By this way, with the feedback that repetition and resource can not take place.In addition, the described situation of Fig. 5 B possibly be the situation of the unique too much copy of reception.Therefore, compare traditional network adapter, EFVC 216 can send to the amount of the flux of multicast of the port of not preparing to receive flow through minimizing, improves flux of multicast and handles.In addition, in some embodiments of the invention, EFVC 216 can send to flux of multicast thenetwork equipment 112 this flux of multicast of mark before, thereby reduces or eliminates the situation shown in Fig. 5 B.In this respect, receive back flux of multicast from thenetwork equipment 112 after, mark can make EFVC 216 know VMs 204₁-204_MIn which has received flow.

Fig. 6 is according to embodiments of the invention, is indicated as network management and duplicates or mirror image is striden the synoptic diagram of virtual machine flow.With reference to Fig. 6,path 602 shows direct VMs 204₁With 204_MBetween clean culture stride the VM flow;Path 604 has shown the corresponding flow that is transferred to supervisory routine 208 fromnetwork adapter 110; Andpath 606 has shown the corresponding flow that is transferred to thenetwork equipment 112 from network adapter 110.Along thepath 604 and/or the corresponding flow ofpath 606 transmission can make by miscellaneous equipment and spend the interior load of decision as flow rate mode and/or the network equipment 102 and/or be used for debugging purpose.

In some cases, 604 can comprise copy along the path like each packet of striding the VM flow with the corresponding flow ofpath 606 transmission, stride the selected packet of VM flow copy, stride the VM flow each packet part copy such as header file or useful load and/or stride the copy of the part (like header file (header) or effective field (payload)) of the selected packet of VM flow.By this way, the flow onpath 602, or its part can be copied to the supervisory routine 208 and/or the network equipment 112.Conversely, the supervisory routine 208 and/or thenetwork equipment 112 can be used outsidenetwork management entity 122 in the network equipment 102, becoming about the information of striding the VM flow.In some cases, thus can revise or the corresponding flow of mark makes it be different from the flow that starts.In addition and/or the two select one of which, along thepath 604 with the flow ofpath 606 transmission can not be the copy of the flow onpath 602, but can report flow throughpath 602 transmission.For example, along thepath 604 with the flow ofpath 606 transmission can be summary and/or the simple announcement information that needs few bandwidth and/or handle resource.

Striding the copy of VM flow or reporting to be purpose with the network management.In this respect; When the network equipment 102 inner routes are striden the VM flow;Network management entity 122 possibly not known this flow; Therefore andnetwork management entity 122 can not count these flows in the network management operation as factor, wherein these operations comprise how to handle likeconfiguration network adapter 110 stride the VM flow, determine whether instantiation and/or migration VMs to go the debugging of load, collection network statistics and network problem on the balancing network or security service is provided such as ACL or type this in this.

The entity of the flow that reception is duplicated (the for example supervisory routine 208 and/or the network equipment 112) can use in the band and/or the outer mechanism of band confirms that flow duplicates.Mechanism can comprise in the band, thereby the flow that duplicates like sign, mark and/or modification goes to show that it is a copy.The outer mechanism of exemplary band comprises signal, message and/or before the flow that duplicates and/or through the channel that is different from the flow that duplicates, sends to other notice of entity.For example, band is outer notifies theconfigurable network equipment 112 to get into the VEPA patterns, and other service (like ACL processing, mirror image, address table expansion etc.) that can configure network devices 112.These configurations can allow thenetwork equipment 112 to go to handle from the flow ofEFVC 216 receptions and for the processing of packet provides service necessary and/or that need, take appropriate action then.These appropriate action for example can comprise and send to EFVC 216 to packet, thereby make EFVC 216 can be only need be forwarded to the destination to the data processed bag, deliver to packet and be used for debugging and/or another equipment and/or the packet discard of extra processing.For example, band is outer notifies configurable entity to get into operator scheme, in this operator scheme all flows be as the flow that duplicates handle up to receiving follow-up notice.For another, to be with outer notice can dispose entity and to get into operator scheme, flow specific in this operator scheme is to handle as the flow that duplicates like next ' K ' packet (K is an integer).Identical, be with outer notice can dispose entity and get into operator scheme, in this operator scheme, the flow that in specified time interval, receives or be to handle as the flow that duplicates through the flow that certain port receives.In addition, the flow that duplicates can be handled with various mode.For example, the supervisory routine 208 and/or thenetwork equipment 112 can determine need not to be forwarded to another network equipment to the flow that duplicates, can only be forwarded tonetwork management entity 122 and/or be forwarded tonetwork management entity 122 to the summary of the flow that duplicates.

Although Fig. 6 has explained at direct VMs 204₁With 204_MBetween unicast traffic, 604 and 606 path also can be used to mail to and/or from eSwitchedVMs 202 and/or directly other clean culture and/or the flux of multicast of VMS 204 similar in appearance to the path.For example, with regard to theVMs 202 of virtual switchization₁With 202_NBetween flow, supervisory routine 208 can be forwarded to theEFVC 216 and/or thenetwork equipment 112 with copy.

In addition, although Fig. 6 has explained thenetwork equipment 112 that mirroring service and/or function are provided, the present invention is unrestricted.In this respect, any other EFVC service can be used for expansion by making of the use of thenetwork equipment 112 or vSwith 210 and/or its relevant software or APIs.Identical ground, EFVC 216 also can be used to expand the service that is provided by vSwith 210.

Fig. 7 is the process flow diagram that the exemplary steps of VM flow is handled in explanation according to the embodiment of the invention.Start from step 702, can power on and/or reseting network equipment 102.In step 704, management information can be transmitted between EFVC 216 and network management entity 122.These management information can be transmitted through the supervisory routine 208 and/or the network equipment 112.In this respect, the network equipment 112 administration agent that can be used as the network equipment 102 moves.In step 706, EFVC 216 can be based on its other part own and/or configuration network adapter 110, supervisory routine 208 and/or the network equipment 102 of management information configuration of transmission.By this way, can dispose and be used to determine to handle in which way regulation, wave filter, performance, strategy, authority and/or other the standard of striding the VM flow.Management information can comprise for example address table, ACL or be stored in being used in the network adapter 110 handles the information similar of flow.ACL can comprise the information that is used to determine the authority relevant with various VMs and/or other network entity.In step 708, a VM who operates on the network equipment 102 can begin to deliver to the 2nd VM that operates on the network equipment 102 to flow.In step 710, can based on by network manager decision and/or go to determine to stride the mode that the VM flow is handled in the various regulations of step 706 configuration, wave filter, factor, authority, performance or any other standard.For example, possibly need ACL to handle for flow, but the network equipment 110 possibly not support ACL or its ACL capacity to overdraw.Externally handle under the situation of flow, exemplary steps advances to step 718.

In step 718, can transmit through theport 220 of thenetwork equipment 112 and stride the VM flow to the network equipment 112.In step 719, thenetwork equipment 112 can go to handle according to the regulation of being set up by user and/or keeper stride the VM flow, and goes the service and/or the function that provideEFVC 216 not provide.In step 720, thenetwork equipment 112 can determine that flow is is the destination with the VM on the network equipment 102, and can correspondingly return to the network equipment 102 to flow through port 220.Equally in step 720, thenetwork equipment 112 can generate and/or upgrade the information that is used for network management.For example, thenetwork equipment 112 can upgrade the table that is used for storing the statistical information relevant with the flow rate mode of network.In addition, in step 720, before forwarding, thenetwork equipment 112 can provide the service that can not implement or realize on the network adapter 110.For example, thenetwork equipment 112 can be carried out the complex processing relevant with implementing one or moresecurity protocols.In step 722, flow can be received bynetwork adapter 110, and can be forwarded to destination VM.

Get back to step 710, flow by the situation of inter-process under, exemplary steps may be advanced to step712.In step 712, can determine thatnetwork adapter 110 is that configuration is used to transmit the copy of striding the VM flow or configuration and is used for reporting and strides the VM flow.Be not used to send copy and/or report ifnetwork adapter 110 also disposes, instep 714, can arrive destination VM to traffic transport then.If having disposed,network adapter 110 is used to send copy and/or report; Then in step 716; Can arrive destination VM to traffic transport, and can be transferred to the copy of flow or the report relevant like the supervisory routine 208 and/or thenetwork equipment 112 with flow.Transmit copy and/or notice subsequently tonetwork management entity 122.

Fig. 8 explains that according to embodiments of the invention address table content in the adapter Network Based comes the process flow diagram of inside or external treatment flow.With reference to Fig. 8, exemplary steps can be in step 802 beginning, and receive flow from local resource such asVM 202 or 204 this moment in networkadapter 110.In step 804, EFVC216 can be the address table of the destination-addresssearch network adapter 110 of flow.When in address table, finding destination-address, exemplary steps can advance to step 806.

Instep 806, can determine flow whether with VMs 202₁-202_NWith VMs 204₁-204_MIn one or more be the destination.When flow is with VMs 202₁-202_NWith VMs 204₁-204_MIn one or more when being the destination, exemplary steps may be advanced to step 810 so.Simultaneously, be with VMs202 at flow₁-202_NWith VMs 204₁-204_MIn one or more be thatEFVC 216 can deliver to thenetwork equipment 112 and/or supervisory routine 208 to the copy of flow or report under the situation of destination.In this case, can send in the band and/or the outer notice of band, thereby thenetwork equipment 112 and/or supervisory routine 208 are known and are arranged to and handle the flow that duplicates.

Instep 810, can pass through suitable VF and/or PF converting flow to VM.

Getting back to step 806, is not withVMs 202 at flow₁-202_NWith VMs 204₁-204_MIn one or more be that exemplary steps advances to step 812 under the situation of destination.

Instep 812, can be sent to thenetwork equipment 112 to flow.In some embodiments of the invention, instep 812 and/or beforestep 812, thereby can be sent to the mode that thenetwork equipment 112 is configured to thenetwork equipment 112 to be used to handle this flow to the outer notice of band.For example, this notice can configurenetwork devices 112 get into the VEPA pattern.Afterstep 812, exemplary steps gets intostep 814.

Instep 814, thenetwork equipment 112 can utilize it maybe thannetwork adapter 110 bigger resources go the decision to where converting flow.In this respect, it possibly be such:EFVC 216 has VMs 204₁-204_MAddress information but do not have a VMs 202₁-202_NAddress information, thereby with VMs202₁-202_NOne or more be that the flow of destination arrives step 814.Under this type situation, thenetwork equipment 112 can feed back to flow on the port that it once arrived.Therefore, through being used to determine that flow must be the identical port of destination with one or more VMs, receive identical flow after,EFVC 216 can be forwarded to vSwitch to packet.In addition, thenetwork equipment 112 can offer the address table thatEFVC 216 goes to upgradenetwork adapter 110 to the outer notice of band, where can be forwarded to thereby EFVC 216 is known.Under the situation of the network equipment 102 outsides, thenetwork equipment 112 can be transmitted this flow through the one or more suitable port that is different from the port that receives flow in the destination.

Get back to step 804, do not find in the address table innetwork adapter 110 under the situation of destination address, exemplary steps can advance to step 812.

By this way, compared to the legacy network devices that just simply is broadcast to flow all VM and thenetwork equipment 112,network adapter 110 can be handled flow more efficiently.

Be same as the above description relevant, can handle flow in a similar manner based on access control list (ACL) or other security mechanism with address table.In this respect; There are enough resources to go to implement under the situation of ACL and/or other security mechanism atEFVC 216;Management entity 122 can be sent toEFVC 216 to ACL information through thenetwork equipment 112 and/or supervisory routine 208, andEFVC 216 can for example determine to transmit or abandon flow according to ACL and/or other security mechanism processing flow.In addition, whenEFVC 216 did not have enough resources to go to be used for storage and/or implements ACL or other security mechanism,EFVC 216 can send to thenetwork equipment 112 to relevant flow, forexample FVC 216 uncertain flow aspect the adaptability of ACL.Thenetwork equipment 112 in the VEPA pattern can be handled flow according to ACL and be back to EFVC 216 to flow then.

The invention provides the various aspects of the method and system that is used for virtual machine network.In exemplary of the present invention; TheEFVC 216 that is arranged in thenetwork adapter 110 of first network equipment 102 can comprise one or more circuit and/or processor; This circuit and/or processor can be used for determining to be the path (likepath 304 and 306) through only being positioned at first network equipment 102; Still the path (like path 350) through comprisingsecond network equipment 112 is come at VMs 202₁-202_NAnd/or VMs 204₁-204_MWherein delivery flow rate between at least two.This decision is the characteristic that is dependent on flow of part at least.This decision is the performance that is dependent onnetwork adapter 110 and/or the available resources of part at least.This decision can be at least part be dependent onEFVC 216 with below the management information that exchanges between at least one: operate in software such as supervisory routine 208,second network equipment 112 and/or the 3rd network equipment on first network equipment.On behalf of first network equipment 102,second network equipment 112 can participate in NMP.Can be through the application programming interface exchange of management information that provides by one or more electrical equipment and/or processor.

When the address information relevant with flow not in the address table ofnetwork adapter 110, can be via the path delivery flow rate that comprises second network equipment 112.Whennetwork adapter 110 can not be carried out when handling the required one or more security function of flow, can be via the path delivery flow rate that comprises second network equipment 112.Whennetwork adapter 110 can not be carried out when handling the required one or more management function of flow, can be via the path delivery flow rate that comprises second network equipment 112.When flow transmitted via the path that comprisessecond network equipment 112,second network equipment 112 can be handled flow and be back to first network equipment 102 to the flow of handling.The processing of being carried out bysecond network equipment 112 comprises like the retrieval address information relevant with flow in the address table ofsecond network equipment 112, carries out required one or more management functions of processing flow and/or execution and handles the required one or more security functions of flow.

Simultaneously,EFVC 216 can be used for the copy flow, or is transferred tosecond network equipment 112 about the report of flow, andsecond network equipment 112 can be used for bookkeeping with the copy of flow.One or more labels, field and/or the header file of flow copy can makesecond network equipment 112 can confirm that the copy of this flow is a copy.In addition or the two select one of which, can makesecond network equipment 112 can confirm that the copy of this flow is a copy from the indication of EFVC 216.Can transmission should indication outside the band of the copy of this flow.

An alternative embodiment of the invention can provide a kind of machine and/or computer-readable memory and/or media; The machine code and/or the computer program of its storer storage comprise at least one code segment; Said at least one code segment is carried out by machine and/or computing machine, thereby makes this machine and/or computing machine carry out the above-mentioned step that is used for virtual machine network.

Therefore, the present invention can pass through hardware, software, and perhaps soft, combination of hardware realizes.The present invention can realize with centralized system at least one computer system, perhaps realized with dispersing mode by the different piece in the computer system that is distributed in several interconnection.Any computer system or miscellaneous equipment that can implementation method all be applicatory.The combination of software and hardware commonly used can be the general-purpose computing system that computer program is installed, and through installing and executive routine control computer system, it is moved by method.

The present invention can also implement through computer program, and program comprises whole characteristics that can realize the inventive method, when it is installed in the computer system, can realize method of the present invention.Computer program in the presents refers to: one group of any expression formula of instructing that can adopt any program language, code or symbol to write; This instruction group makes system have information processing capability; With direct realization specific function, or after carrying out following one or two step, realize specific function: a) convert other Languages, decoding or symbol to; B) reproduce with different forms.

Though the present invention describes through specific embodiment, it will be appreciated by those skilled in the art that, without departing from the present invention, can also carry out various conversion and be equal to alternative the present invention.In addition, to particular condition or material, can make various modifications to the present invention, and not depart from the scope of the present invention.Therefore, the present invention is not limited to disclosed specific embodiment, and should comprise the whole embodiments that fall in the claim scope of the present invention.

The cross reference of related application

Present patent application with reference to and U.S. Provisional Patent Application, the application number of enjoying on February 27th, 2009 application be No.61/156,186 right of priority, above-mentioned here patented claim all quotes in full, with for referencial use.

Claims (15)

1. a system that is used for network is characterized in that, comprising:

The one or more circuit and/or processor, described one or more circuit and/or the processor that are used in the network adapter of first network equipment are used for:

Decision is through only being positioned at the path of said first network equipment; Still come delivery flow rate between the virtual machine that moves on said first network equipment through the path that is included in second network equipment outside said first network equipment, said decision is based on the characteristic of said flow.

2. the system of claim 1 is characterized in that, said decision is based on the management information of exchange between said one or more circuit and/or processor and the following at least one item:

Operate in resident (host-resident) software of master on said first network equipment;

Said second network equipment; And

The 3rd network equipment.

3. the system of claim 1 is characterized in that, said decision is based on the performance and/or the available resources of said network adapter.

4. the system of claim 1; It is characterized in that; Transmitting under the situation of said flow through the said path that comprises second network equipment, said second network equipment is carried out the processing to said flow, is back to said first network equipment to the flow of said processing then.

5. system as claimed in claim 4 is characterized in that, not under the situation in the address table in said network adapter, transmits said flow through the said path that comprises said second network equipment in the address information relevant with said flow.

6. system as claimed in claim 5 is characterized in that, said processing is included in the address table of said second network equipment and searches the address information relevant with said flow.

7. system as claimed in claim 4 is characterized in that, can not carry out when handling the needed one or more management function of said flow when said network adapter, transmits said flow through the said path that comprises said second network equipment.

8. system as claimed in claim 7 is characterized in that, said processing comprises carries out said management function.

9. system as claimed in claim 4 is characterized in that, can not carry out one when handling the needed one or more security function of said flow when said network adapter, transmits said flow through the said path that comprises said second equipment.

10. system as claimed in claim 9 is characterized in that, said processing comprises carries out said one or more security functions.

11. the system of claim 1 is characterized in that, on behalf of said first network equipment, said second network equipment participate in NMP.

12. the system of claim 1 is characterized in that, be transferred to second network equipment the copy of said flow or about the report of said flow, and said second network equipment is the said copy that bookkeeping utilizes said flow.

13. system as claimed in claim 12 is characterized in that, one or more labels, field and/or the header file of the said copy of said flow enables said second network equipment and confirms that the said copy of said flow is a copy.

14. system as claimed in claim 12; It is characterized in that; Described one or more circuit and/or processor are used to generate and enable said second network equipment and confirm that the said copy of said flow is the notice of copy, and wherein said notice is the outer transmission of band with respect to the said copy of said flow.

15. the system of claim 1; It is characterized in that; Said one or more circuit and/or processor are that the said supervisory routine and/or said second network equipment provide API, and said API is used to dispose said network adapter.

Images